Northwood, Inc

Northwood, Inc., a business associate (BA) of Blue Care Network and Blue Cross Blue Shield of Michigan, reported that an employee was the victim of an email phishing scheme that affected the protected health information (PHI) of approximately 18,684 individuals. The PHI involved included names, addresses, dates of birth, health insurance information, and treatment information. Northwood notified HHS, affected individuals, the media, and the FBI. In its mitigation efforts, Northwood implemented additional administrative technical, and security safeguards to better protect its PHI. OCR obtained assurances that Northwood implemented the corrective action noted.